Vulnerabilidades do Ghostrobotics Vision 60
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Ghostrobotics Vision 60: 6 registro(s), com versões afetadas e correções.
CVE-2026-12991
Alta · 8.7
CWE-300 27/07/2026
Multiple vulnerabilities in Ghost Robotics' Vision 60
The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and selective traffic blocking techniques to intercept and manipulate packets between the legitimate operator and the robot. This allows the attacker to disconnect the original controller, establish unauthorized communications, and prevent the operator from regaining control of the device, seriously compromising the confidentiality, integrity, and availability (CIA) of operations.
CVE-2026-12990
Alta · 7.7
CWE-284 27/07/2026
Multiple vulnerabilities in Ghost Robotics' Vision 60
An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active, legitimate session. This allows the attacker to bypass control restrictions, intercept sensitive information (such as real-time video), and partially interact with the system unnoticed and without disconnecting the legitimate user, compromising confidentiality and operational security.
CVE-2026-12989
Alta · 8.7
CWE-306 27/07/2026
Multiple vulnerabilities in Ghost Robotics' Vision 60
A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization mechanisms, the attacker can view real-time camera feeds, control the robot’s movements, manage sensors (GPS, RTK, SAM, LIDAR), and execute critical operational commands (Play, Pause, Stop, E-Stop). Successful exploitation completely compromises the confidentiality, integrity, and physical security of the system.
CVE-2025-41110
Alta · 8.8
CWE-306 22/10/2025
Improper Authentication vulnerability in Ghost Robotics' Vision 60
Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi and view all its data, as it runs on ROS 2 without default authentication. In addition, the attacker can connect via SSH and gain full control of the robot, which could cause physical damage to the robot itself or its environment.
CVE-2025-41109
Média · 4.6
CWE-798 22/10/2025
Use of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 60
Ghost Robotics Vision 60 v0.27.2 includes, among its physical interfaces, three RJ45 connectors and a USB Type-C port. The vulnerability is due to the lack of authentication mechanisms when establishing connections through these ports. Specifically, with regard to network connectivity, the robot's internal router automatically assigns IP addresses to any device physically connected to it. An attacker could connect a WiFi access point under their control to gain access to the robot's network without needing the credentials for the deployed network. Once inside, the attacker can monitor all its data, as the robot runs on ROS 2 without authentication by default.
CVE-2025-41108
Crítica · 9.8
CWE-287 22/10/2025
Autenticação inadequada no protocolo de controle do robô Ghost Robotics Vision 60
O protocolo de comunicação implementado no Ghost Robotics Vision 60 v0.27.2 poderia permitir que um atacante enviasse comandos ao robô a partir de uma estação de ataque externa, personificando a estação de controle (tablet) e obtendo controle total e não autorizado do robô. A ausência de mecanismos de criptografia e autenticação no protocolo de comunicação permite que um atacante capture o tráfego legítimo entre o robô e o controlador, o replique e envie qualquer comando válido ao robô a partir de qualquer computador ou dispositivo de ataque. O protocolo de comunicação usado nesta interface é baseado no MAVLink, um protocolo amplamente documentado, o que aumenta a probabilidade de ataque. Há dois métodos para conectar-se remotamente ao robô: Wi-Fi e 4G/LTE.